European Cybersecurity Skills Framework (ECSF)

The European Cybersecurity Skills Framework (ECSF) is a practical tool to support the identification and articulation of tasks, competences, skills and knowledge associated with the roles of European cybersecurity professionals. It is the EU reference point for defining and assessing relevant skills, as defined in the Cybersecurity Skills Academy, which was recently announced by the European Commission.

The ECSF summarises the cybersecurity-related roles into 12 profiles, which are individually analysed into the details of their corresponding responsibilities, skills, synergies and interdependencies.  It provides a common understanding of the relevant roles, competencies, skills and knowledge mostly required in cybersecurity, facilitates recognition of cybersecurity skills, and supports the design of cybersecurity-related training programmes.

The framework and the corresponding user manual were presented during the 1^st ENISA cybersecurity skills conference, in September 2022.

Closing remarks of the 1st ENISA conference on skills were delivered by Despina Spanou, Head of Cabinet for European Commission Vice-President Margaritis Schinas, who stated: " We now need to make sure that we address what could become our biggest challenge: how to have the right people with the right skills to shield our citizens and our economies from ever more pervasive cyberattacks across all critical sectors. On the eve of 2023 European Year of Skills, the European Cybersecurity Skills Framework will be a tangible tool to help identify the profiles of jobs that are the most necessary in the field. It can become an enabler of a common European language on cybersecurity skills across the whole European cyber ecosystem and a building block for the Commission’s work on a genuine Cybersecurity Skills Academy"

Within this context, in April 2023, the Commission adopted the Communication on a Cybersecurity Skills Academy, a policy initiative which aims to bring together existing initiatives on cyber skills and improve their coordination, with a view to bridging the cybersecurity talent gap and boosting competitiveness, growth and resilience in the EU. The ECSF constitutes the basis on which the Academy will define and assess relevant skills, monitor the evolution of the skill gaps and provide indications on the new needs.

The impact and the future of the ECSF, as well as its role in the Academy, were elaborated in the 2^nd edition of the ENISA Cybersecurity Skills Conference, which took place in September 2023, in Segovia, Spain.

More information about the ECSF

The framework is presented in detail in the two documents : 

• The ECSF Role Profiles document – Listing the 12 typical cybersecurity professional role profiles along with their identified titles, missions, tasks, skills, knowledge, competences.
• The ECSF User Manual document – Providing guidance and practical examples on how to leverage the framework and benefit from it as an organisation, provider of learning programmes or individual.

Also, in the following recorded webinars of #ECSFtalks::

• ECSF explanatory video (3 min)
• Principles, vision, structure and benefits of the ECSF
• Assessing Cyber Skills on the basis of the ECSF
• Take a walk on the CISO side

ECSF Goals in Brief

1. Use of the ECSF ensures a common terminology and shared understanding between the demand (workplace, recruitment) and supply (qualification, training) of cybersecurity professionals across the EU.  
2. The ECSF supports the identification of the critical skill sets required from a workforce perspective. It enables providers of learning programmes to support the development of this critical set of skills and helps policy-makers support targeted initiatives to mitigate the gaps identified in skills.  
3. The framework facilitates an understanding of leading cybersecurity professional roles and the essential skills they require, including soft skills, along with the legislative aspects (if any). In particular, it enables non-experts and HR departments to understand the requirements for resource planning, recruitment and career planning in supporting cybersecurity. 
4. The framework promotes harmonisation in cybersecurity education, training, and workforce development. At the same time, this common European language in the context of cybersecurity skills and roles connects well with the entire ICT professional domain.  
5. The ECSF contributes to achieving enhanced shielding against cyberattacks and to ensuring secure IT systems in society. It provides a standard structure and advice on how to implement capacity building within the European cybersecurity workforce. 

How ENISA will support the governance, implementation and evolution of the ECSF

With the support of a dedicated Ad hoc Working Group, ENISA will continue to work on the implementation and evolution of the ECSF, towards its overall goal to work with EU communities and develop cybersecurity competencies aligned with the ECSF for cybersecurity professionals. 

Cyber Higher Education Database (CyberHEAD)

The Cybersecurity Higher Education Database (CyberHEAD) is the largest catalogue of cybersecurity academic programme in the EU and EFTA countries. The web tool offers numerous search options and many filters to help students find the programme that suits their interest.

The mapping of CyberHEAD’s programmes with the ECSF role profiles is helping students to make guided learning choices and understand potential career paths, and so bridge the gap between professional workplaces and learning environments.

For any questions or further enquiries on the ECSF or CyberHEAD please contact us at euskills(a)enisa.europa.eu.